Crypto Fails Logo

Crypto Fails

0
Free
Updated 11 March 2025
Visit Website

Showcasing bad cryptography. Archive Ask Crypto Questions About Reasoning by Lego: The wrong way to think about cryptography. Scott Arciszewski from Paragon Initiative pointed me to this example of PHP cryptography. The code is bad and the crypto design is flawed, but as usual for this blog, we can learn something from it. Let’s ignore the fact that it’s using MCRYPT_RIJNDAEL_256 (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES), the fact that it’s not checking the return value of substr(), and the fact that it’s passing a hexadecimal-encoded key to a function that expects a binary string. I’ve covered all of these failings on this blog before, so I won’t touch on them again. Instead, let’s focus on two facts. First, it is doing “MAC then Encrypt” (MtA), which means the Message Authentication Code (MAC) is being applied to the plaintext message before encryption – contrary to modern crypto wisdom. Second, that the MAC is checked with a non-timing-safe comparison, which means that if an attacker can get really precise timing measurements of a failed decryption, they can find out how much of the MAC matches. In the “Encrypt then MAC” (EtM) design, where the MAC is applied to the ciphertext after encryption, this kind of a timing leak usually lets you forge a message. But this time, the MAC is inside the ciphertext, encrypted, so at a first glance, exploiting it seems more difficult. Indeed, the issue was brought up

FEATURES

SIMILAR TOOLS

A steganographic file system in userspace for plausible deniability of files.

Steghide is a steganography program that hides data in image and audio files.

A tool for creating cryptographically strong volumes that destroy themselves upon tampering or via issued command.

A utility tool for decrypting data from weak public keys and attempting to recover the corresponding private key, primarily for educational purposes.

Simple C++ Encryption and Steganography tool for hiding files inside images using LSB encoding.

Automated tool for detecting steganographic content in images, with F5 detection capabilities.

A versatile steganography tool with various installation options and detailed usage instructions.

A project focusing on deconstructing and utilizing data for security using Python modules like IPython, Pandas, and Scikit Learn.

Pack up to 3MB of data into a tweetable PNG polyglot file.

PINNED

Proton Pass Logo

Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.

Data Protection
NordVPN Logo

NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.

Network Security
Mandos Logo

Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.

Consulting
Checkmarx SCA Logo

Checkmarx SCA

A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.

Application Security
Orca Security Logo

Orca Security

A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.

Cloud Security
DryRun Logo

DryRun

A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.

Application Security
CyberSecTools logoCyberSecTools

Explore the largest curated directory of cybersecurity tools and resources to enhance your security practices. Find the right solution for your domain.

Operated by:

Mandos Cyber • KVK: 97994448

Netherlands • contact@mandos.io

VAT: NL005301434B12

Copyright © 2025 - All rights reserved